MFH: fix crash setting attr from foreign doc (throws exception)

add test

ext/dom/element.c

@@ -368,6 +368,11 @@ PHP_FUNCTION(dom_element_set_attribute_node)
 		RETURN_FALSE;
 	}
 
+	if (!(attrp->doc == NULL || attrp->doc == nodep->doc)) {
+		php_dom_throw_error(WRONG_DOCUMENT_ERR, dom_get_strict_error(intern->document) TSRMLS_CC);
+		RETURN_FALSE;
+	}
+
 	existattrp = xmlHasProp(nodep, attrp->name);
 	if (existattrp != NULL && existattrp->type != XML_ATTRIBUTE_DECL) {
 		if ((oldobj = php_dom_object_get_data((xmlNodePtr) existattrp)) != NULL && 
@@ -769,6 +774,11 @@ PHP_FUNCTION(dom_element_set_attribute_node_ns)
 		RETURN_FALSE;
 	}
 
+	if (!(attrp->doc == NULL || attrp->doc == nodep->doc)) {
+		php_dom_throw_error(WRONG_DOCUMENT_ERR, dom_get_strict_error(intern->document) TSRMLS_CC);
+		RETURN_FALSE;
+	}
+
     nsp = attrp->ns;
     if (nsp != NULL) {
         existattrp = xmlHasNsProp(nodep, nsp->href, attrp->name);

ext/dom/tests/dom_set_attr_node.phpt

@@ -0,0 +1,67 @@
+--TEST--
+Test: setAttributeNode()
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+
+$xml = <<<HERE
+<?xml version="1.0" ?>
+<root a="b" />
+HERE;
+
+$xml2 = <<<HERE
+<?xml version="1.0" ?>
+<doc2 />
+HERE;
+
+$dom = new DOMDocument();
+$dom->loadXML($xml);
+$root = $dom->documentElement;
+$attr = $root->getAttributeNode('a');
+
+$dom2 = new DOMDocument();
+$dom2->loadXML($xml2);
+$root2 = $dom2->documentElement;
+try {
+   $root2->setAttributeNode($attr);
+} catch (domexception $e) {
+    var_dump($e);
+} 
+
+?>
+--EXPECTF--
+object(DOMException)#%d (6) {
+  ["message:protected"]=>
+  string(20) "Wrong Document Error"
+  ["string:private"]=>
+  string(0) ""
+  ["file:protected"]=>
+  string(%d) "%sdom_set_attr_node.php"
+  ["line:protected"]=>
+  int(22)
+  ["trace:private"]=>
+  array(1) {
+    [0]=>
+    array(6) {
+      ["file"]=>
+      string(%d) "%sdom_set_attr_node.php"
+      ["line"]=>
+      int(22)
+      ["function"]=>
+      string(16) "setAttributeNode"
+      ["class"]=>
+      string(10) "DOMElement"
+      ["type"]=>
+      string(2) "->"
+      ["args"]=>
+      array(1) {
+        [0]=>
+        object(DOMAttr)#%d (0) {
+        }
+      }
+    }
+  }
+  ["code"]=>
+  int(4)
+}